Privilege Escalation Affecting jinja2 package, versions [,2.7.2)
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-JINJA2-40250
- published 18 Jan 2014
- disclosed 18 Jan 2014
- credit Arun Babu Neelicattu
Introduced: 18 Jan 2014
CVE-2014-0012 Open this link in a new tabHow to fix?
Upgrade Jinja2 to version 2.7.2 or higher.
Overview
Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.
Affected versions of this package are vulnerable to Privilege Escalation due to not properly creating temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's UID.
NOTE: This vulnerability exists because of an incomplete fix for CVE-2014-1402.
References
CVSS Scores
version 3.1